Adding possibility for sputnik to load additional SpotBugs plugins like find-sec-bugs

.github/workflows/publish.yml

@@ -1,7 +1,11 @@
 name: Publish package to the Maven Central Repository
 on:
-  release:
-    types: [created]
+  workflow_dispatch:
+    inputs:
+      nextVersion:
+        description: 'Next version number'
+        required: true
+        default: '2.3.1'
 jobs:
   publish:
     runs-on: ubuntu-latest
@@ -11,8 +15,16 @@ jobs:
         uses: actions/setup-java@v1
         with:
           java-version: 1.8
+      - name: Current version
+        run: ./gradlew currentVersion
+      - name: Mark next version
+        run: ./gradlew markNextVersion -Prelease.version=${{ github.event.inputs.nextVersion }}
+      - name: Release
+        run: ./gradlew release
+      - name: Release version
+        run: ./graldew currentVersion
       - name: Publish package
-        run: gradle publish
+        run: ./gradlew publish
         env:
           SONATYPE_USERNAME: ${{ secrets.SONATYPE_USERNAME }}
           SONATYPE_PASSWORD: ${{ secrets.SONATYPE_PASSWORD }}

README.md

@@ -32,6 +32,7 @@ pmd.ruleSets=rulesets/java/android.xml,rulesets/java/basic.xml
 spotbugs.enabled=true
 spotbugs.includeFilter=
 spotbugs.excludeFilter=
+spotbugs.plugins.location=/opt/sputnik/SpotBugsPlugins
 codenarc.enabled=true
 codenarc.ruleSets=
 codenarc.excludes=**/*.java

build.gradle

@@ -34,7 +34,7 @@ configurations {
     }
 }
 
-project.version = '2.3.1.1' //scmVersion.version
+project.version = scmVersion.version
 
 sourceCompatibility = 1.8
 targetCompatibility = 1.8
@@ -181,6 +181,20 @@ java {
     withSourcesJar()
 }
 
+distZip {
+    into(project.name + "-" + project.version) {
+        from '.'
+        include 'SpotBugsPlugins/*'
+    }
+}
+
+distTar {
+    into(project.name + "-" + project.version) {
+        from '.'
+        include 'SpotBugsPlugins/*'
+    }
+}
+
 jar {
     manifest {
         attributes("Specification-Title": "Sputnik",
@@ -204,7 +218,7 @@ publishing {
             pom {
                 groupId = 'pl.touk'
                 name = 'Sputnik'
-                description  = 'Static code review for your Gerrit and Stash patchsets. Runs Checkstyle, PMD and SpotBugs for you!'
+                description = 'Static code review for your Gerrit and Stash patchsets. Runs Checkstyle, PMD and SpotBugs for you!'
                 url = 'https://github.com/TouK/sputnik/'
                 scm {
                     url = 'scm:git@github.com:TouK/sputnik.git'
@@ -234,8 +248,6 @@ publishing {
 }
 
 signing {
-    def signingKey = System.getenv('SIGNING_KEY')
-    def signingPassword = System.getenv('SIGNING_PASSWORD')
-    useInMemoryPgpKeys(signingKey, signingPassword)
+    useInMemoryPgpKeys(System.getenv('SIGNING_KEY'), System.getenv('SIGNING_PASSWORD'))
     sign publishing.publications.mavenJava
 }

src/main/java/pl/touk/sputnik/configuration/GeneralOption.java

@@ -51,6 +51,7 @@ public enum GeneralOption implements ConfigurationOption {
     SPOTBUGS_ENABLED("spotbugs.enabled", "SpotBugs enabled", "false"),
     SPOTBUGS_INCLUDE_FILTER("spotbugs.includeFilter", "SpotBugs include filter file", ""),
     SPOTBUGS_EXCLUDE_FILTER("spotbugs.excludeFilter", "SpotBugs exclude filter file", ""),
+    SPOTBUGS_PLUGINS_LOCATION("spotbugs.plugins.location", "SpotBugs plugins path to jar files", "SpotBugsPlugins"),
 
     SCALASTYLE_ENABLED("scalastyle.enabled", "ScalaStyle enabled", "false"),
     SCALASTYLE_CONFIGURATION_FILE("scalastyle.configurationFile", "ScalaStyle configuration file", ""),

src/main/java/pl/touk/sputnik/processor/spotbugs/SpotBugsProcessor.java

@@ -4,9 +4,15 @@
 import edu.umd.cs.findbugs.DetectorFactoryCollection;
 import edu.umd.cs.findbugs.FindBugs2;
 import edu.umd.cs.findbugs.IClassScreener;
+import edu.umd.cs.findbugs.Plugin;
+import edu.umd.cs.findbugs.PluginException;
 import edu.umd.cs.findbugs.Priorities;
 import edu.umd.cs.findbugs.Project;
 import edu.umd.cs.findbugs.config.UserPreferences;
+import java.io.File;
+import java.net.URI;
+import java.net.URISyntaxException;
+import java.util.Objects;
 import lombok.extern.slf4j.Slf4j;
 import org.apache.commons.lang3.StringUtils;
 import org.jetbrains.annotations.NotNull;
@@ -23,9 +29,11 @@
 
 @Slf4j
 public class SpotBugsProcessor implements ReviewProcessor {
+
     private static final String SOURCE_NAME = "SpotBugs";
 
     private final CollectorBugReporter collectorBugReporter;
+
     private final Configuration config;
 
     public SpotBugsProcessor(@NotNull Configuration configuration) {
@@ -53,6 +61,7 @@ public String getName() {
     }
 
     public FindBugs2 createFindBugs2(Review review) {
+        loadAllSpotbugsPlugins();
         FindBugs2 findBugs = new FindBugs2();
         findBugs.setProject(createProject(review));
         findBugs.setBugReporter(collectorBugReporter);
@@ -121,4 +130,23 @@ private String getExcludeFilterFilename() {
         log.info("Using SpotBugs exclude filter file {}", excludeFilterFilename);
         return excludeFilterFilename;
     }
+
+    private void loadAllSpotbugsPlugins() {
+        String pluginsLocation = config.getProperty(GeneralOption.SPOTBUGS_PLUGINS_LOCATION);
+        if (pluginsLocation != null) {
+            File[] pluginsList = new File(pluginsLocation).listFiles();
+            for (File plugin : Objects.requireNonNull(pluginsList)) {
+                if (plugin.getName().contains(".jar")) {
+                    log.info("SpotBugs additional plugin loading: file://{}", plugin);
+                    try {
+                        Plugin.getAllPlugins().add(Plugin.addCustomPlugin(new URI("file://" + plugin.getAbsoluteFile())));
+                    } catch (PluginException e) {
+                        log.info("Spotbugs additional plugins not loaded {} plugin not supported", e.getMessage());
+                    } catch (URISyntaxException e) {
+                        log.info("Spotbugs additional plugins not loaded {} check path", e.getMessage());
+                    }
+                }
+            }
+        }
+    }
 }

src/main/resources/example.properties

@@ -33,6 +33,7 @@ pmd.showViolationDetails=true
 spotbugs.enabled=true
 spotbugs.includeFilter=
 spotbugs.excludeFilter=
+spotbugs.plugins.location=
 
 scalastyle.enabled=true
 scalastyle.configurationFile=

src/test/java/pl/touk/sputnik/processor/spotbugs/SpotBugsProcessorTest.java

@@ -1,7 +1,8 @@
 package pl.touk.sputnik.processor.spotbugs;
-
 import com.google.common.collect.ImmutableList;
 import com.google.common.collect.ImmutableMap;
+import edu.umd.cs.findbugs.Plugin;
+import java.util.List;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 import pl.touk.sputnik.TestEnvironment;
@@ -11,9 +12,6 @@
 import pl.touk.sputnik.review.ReviewFile;
 import pl.touk.sputnik.review.ReviewFormatterFactory;
 import pl.touk.sputnik.review.ReviewResult;
-
-import java.util.List;
-
 import static org.assertj.core.api.Assertions.assertThat;
 
 class SpotBugsProcessorTest extends TestEnvironment {
@@ -54,4 +52,10 @@ void shouldReturnEmptyWhenNoFilesToReview() {
         assertThat(reviewResult.getViolations()).isEmpty();
     }
 
+    @Test
+    void shouldLoadSpotbugsPlugins() {
+        spotBugsProcessor.createFindBugs2(nonExistentReview());
+        assertThat(Plugin.getAllPlugins()).isNotEmpty();
+    }
+
 }

src/test/resources/test.properties

@@ -11,6 +11,7 @@ pmd.ruleSets=rulesets/java/android.xml,rulesets/java/basic.xml,rulesets/java/bra
 spotbugs.enabled=true
 spotbugs.includeFilter=
 spotbugs.excludeFilter=
+spotbugs.plugins.location=SpotBugsPlugins
 jslint.enabled=true
 scalastyle.configurationFile=src/test/resources/scalastyle.xml
 jshint.enabled=true